STIGQter: STIG Summary: VMware vSphere 7.0 ESXi Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 02 Apr 2025:

Access to the ESXi host must be limited by enabling lockdown mode.

DISA Rule

SV-256375r958398_rule

Vulnerability Number

V-256375

Group Title

SRG-OS-000027-VMM-000080

Rule Version

ESXI-70-000001

Severity

CAT II

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.
• CCI-001682 - Automatically removes or disables emergency accounts after an organization-defined time period for each type of account.

Weight

10

Fix Recommendation

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Security Profile >> Lockdown Mode.

Click "Edit...". Select the "Normal" or "Strict" radio buttons.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$level = "lockdownNormal" OR "lockdownStrict"
$vmhost = Get-VMHost -Name <hostname> | Get-View
$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
$lockdown.ChangeLockdownMode($level)

Note: In strict lockdown mode, the Direct Console User Interface (DCUI) service is stopped. If the connection to vCenter Server is lost and the vSphere Client is no longer available, the ESXi host becomes inaccessible.

Check Contents

For environments that do not use vCenter server to manage ESXi, this is not applicable.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Security Profile.

Scroll down to "Lockdown Mode" and verify it is set to "Enabled" (Normal or Strict).

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}

If "Lockdown Mode" is disabled, this is a finding.

Vulnerability Number

V-256375

Documentable

False

Rule Version

ESXI-70-000001

Severity Override Guidance

For environments that do not use vCenter server to manage ESXi, this is not applicable.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Security Profile.

Scroll down to "Lockdown Mode" and verify it is set to "Enabled" (Normal or Strict).

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}

If "Lockdown Mode" is disabled, this is a finding.

Check Content Reference

M

Target Key

5518